
   SUSE Security Update: Security update for java-11-openjdk
______________________________________________________________________________

Announcement ID:    SUSE-SU-2022:0816-1
Rating:             moderate
References:         #1194925 #1194926 #1194927 #1194928 #1194929 
                    #1194930 #1194931 #1194932 #1194933 #1194934 
                    #1194935 #1194937 #1194939 #1194940 #1194941 
                    
Cross-References:   CVE-2022-21248 CVE-2022-21277 CVE-2022-21282
                    CVE-2022-21283 CVE-2022-21291 CVE-2022-21293
                    CVE-2022-21294 CVE-2022-21296 CVE-2022-21299
                    CVE-2022-21305 CVE-2022-21340 CVE-2022-21341
                    CVE-2022-21360 CVE-2022-21365 CVE-2022-21366
                   
CVSS scores:
                    CVE-2022-21248 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21248 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21277 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21277 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21282 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                    CVE-2022-21282 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                    CVE-2022-21283 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21283 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21291 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21291 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21293 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21293 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21294 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21294 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                    CVE-2022-21296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
                    CVE-2022-21299 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21299 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21305 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21305 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
                    CVE-2022-21340 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21340 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21341 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21341 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21360 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21360 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21365 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21365 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21366 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
                    CVE-2022-21366 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:
                    SUSE Linux Enterprise Desktop 15-SP3
                    SUSE Linux Enterprise High Performance Computing 15-SP3
                    SUSE Linux Enterprise Module for Basesystem 15-SP3
                    SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3
                    SUSE Linux Enterprise Realtime Extension 15-SP2
                    SUSE Linux Enterprise Server 15-SP3
                    SUSE Linux Enterprise Server for SAP Applications 15-SP3
                    SUSE Manager Proxy 4.2
                    SUSE Manager Server 4.2
______________________________________________________________________________

   An update that fixes 15 vulnerabilities is now available.

Description:

   This update for java-11-openjdk fixes the following issues:

   - CVE-2022-21248: Fixed incomplete deserialization class filtering in
     ObjectInputStream. (bnc#1194926)
   - CVE-2022-21277: Fixed incorrect reading of TIFF files in
     TIFFNullDecompressor. (bnc#1194930)
   - CVE-2022-21282: Fixed Insufficient URI checks in the XSLT
     TransformerImpl. (bnc#1194933)
   - CVE-2022-21283: Fixed unexpected exception thrown in regex Pattern.
     (bnc#1194937)
   - CVE-2022-21291: Fixed Incorrect marking of writeable fields.
     (bnc#1194925)
   - CVE-2022-21293: Fixed Incomplete checks of StringBuffer and
     StringBuilder during deserialization. (bnc#1194935)
   - CVE-2022-21294: Fixed Incorrect IdentityHashMap size checks during
     deserialization. (bnc#1194934)
   - CVE-2022-21296: Fixed Incorrect access checks in XMLEntityManager.
     (bnc#1194932)
   - CVE-2022-21299: Fixed Infinite loop related to incorrect handling of
     newlines in XMLEntityScanner. (bnc#1194931)
   - CVE-2022-21305: Fixed Array indexing issues in LIRGenerator.
     (bnc#1194939)
   - CVE-2022-21340: Fixed Excessive resource use when reading JAR manifest
     attributes. (bnc#1194940)
   - CVE-2022-21341: Fixed OpenJDK: Insufficient checks when deserializing
     exceptions in ObjectInputStream. (bnc#1194941)
   - CVE-2022-21360: Fixed Excessive memory allocation in BMPImageReader.
     (bnc#1194929)
   - CVE-2022-21365: Fixed Integer overflow in BMPImageReader. (bnc#1194928)
   - CVE-2022-21366: Fixed Excessive memory allocation in TIFF*Decompressor.
     (bnc#1194927)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Realtime Extension 15-SP2:

      zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-816=1

   - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3:

      zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-816=1

   - SUSE Linux Enterprise Module for Basesystem 15-SP3:

      zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-816=1



Package List:

   - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64):

      java-11-openjdk-11.0.14.0-3.74.2
      java-11-openjdk-debugsource-11.0.14.0-3.74.2
      java-11-openjdk-demo-11.0.14.0-3.74.2
      java-11-openjdk-devel-11.0.14.0-3.74.2
      java-11-openjdk-headless-11.0.14.0-3.74.2

   - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64):

      java-11-openjdk-jmods-11.0.14.0-3.74.2

   - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (noarch):

      java-11-openjdk-javadoc-11.0.14.0-3.74.2

   - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64):

      java-11-openjdk-11.0.14.0-3.74.2
      java-11-openjdk-debugsource-11.0.14.0-3.74.2
      java-11-openjdk-demo-11.0.14.0-3.74.2
      java-11-openjdk-devel-11.0.14.0-3.74.2
      java-11-openjdk-headless-11.0.14.0-3.74.2


References:

   https://www.suse.com/security/cve/CVE-2022-21248.html
   https://www.suse.com/security/cve/CVE-2022-21277.html
   https://www.suse.com/security/cve/CVE-2022-21282.html
   https://www.suse.com/security/cve/CVE-2022-21283.html
   https://www.suse.com/security/cve/CVE-2022-21291.html
   https://www.suse.com/security/cve/CVE-2022-21293.html
   https://www.suse.com/security/cve/CVE-2022-21294.html
   https://www.suse.com/security/cve/CVE-2022-21296.html
   https://www.suse.com/security/cve/CVE-2022-21299.html
   https://www.suse.com/security/cve/CVE-2022-21305.html
   https://www.suse.com/security/cve/CVE-2022-21340.html
   https://www.suse.com/security/cve/CVE-2022-21341.html
   https://www.suse.com/security/cve/CVE-2022-21360.html
   https://www.suse.com/security/cve/CVE-2022-21365.html
   https://www.suse.com/security/cve/CVE-2022-21366.html
   https://bugzilla.suse.com/1194925
   https://bugzilla.suse.com/1194926
   https://bugzilla.suse.com/1194927
   https://bugzilla.suse.com/1194928
   https://bugzilla.suse.com/1194929
   https://bugzilla.suse.com/1194930
   https://bugzilla.suse.com/1194931
   https://bugzilla.suse.com/1194932
   https://bugzilla.suse.com/1194933
   https://bugzilla.suse.com/1194934
   https://bugzilla.suse.com/1194935
   https://bugzilla.suse.com/1194937
   https://bugzilla.suse.com/1194939
   https://bugzilla.suse.com/1194940
   https://bugzilla.suse.com/1194941

SUSE: 2022:0816-1 moderate: java-11-openjdk

March 14, 2022

An update that fixes 15 vulnerabilities is now available

Summary

This update for java-11-openjdk fixes the following issues: - CVE-2022-21248: Fixed incomplete deserialization class filtering in ObjectInputStream. (bnc#1194926) - CVE-2022-21277: Fixed incorrect reading of TIFF files in TIFFNullDecompressor. (bnc#1194930) - CVE-2022-21282: Fixed Insufficient URI checks in the XSLT TransformerImpl. (bnc#1194933) - CVE-2022-21283: Fixed unexpected exception thrown in regex Pattern. (bnc#1194937) - CVE-2022-21291: Fixed Incorrect marking of writeable fields. (bnc#1194925) - CVE-2022-21293: Fixed Incomplete checks of StringBuffer and StringBuilder during deserialization. (bnc#1194935) - CVE-2022-21294: Fixed Incorrect IdentityHashMap size checks during deserialization. (bnc#1194934) - CVE-2022-21296: Fixed Incorrect access checks in XMLEntityManager. (bnc#1194932) - CVE-2022-21299: Fixed Infinite loop related to incorrect handling of newlines in XMLEntityScanner. (bnc#1194931) - CVE-2022-21305: Fixed Array indexing issues in LIRGenerator. (bnc#1194939) - CVE-2022-21340: Fixed Excessive resource use when reading JAR manifest attributes. (bnc#1194940) - CVE-2022-21341: Fixed OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream. (bnc#1194941) - CVE-2022-21360: Fixed Excessive memory allocation in BMPImageReader. (bnc#1194929) - CVE-2022-21365: Fixed Integer overflow in BMPImageReader. (bnc#1194928) - CVE-2022-21366: Fixed Excessive memory allocation in TIFF*Decompressor. (bnc#1194927) Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Realtime Extension 15-SP2: zypper in -t patch SUSE-SLE-Product-RT-15-SP2-2022-816=1 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3: zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-816=1 - SUSE Linux Enterprise Module for Basesystem 15-SP3: zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP3-2022-816=1 Package List: - SUSE Linux Enterprise Realtime Extension 15-SP2 (x86_64): java-11-openjdk-11.0.14.0-3.74.2 java-11-openjdk-debugsource-11.0.14.0-3.74.2 java-11-openjdk-demo-11.0.14.0-3.74.2 java-11-openjdk-devel-11.0.14.0-3.74.2 java-11-openjdk-headless-11.0.14.0-3.74.2 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (aarch64 ppc64le s390x x86_64): java-11-openjdk-jmods-11.0.14.0-3.74.2 - SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (noarch): java-11-openjdk-javadoc-11.0.14.0-3.74.2 - SUSE Linux Enterprise Module for Basesystem 15-SP3 (aarch64 ppc64le s390x x86_64): java-11-openjdk-11.0.14.0-3.74.2 java-11-openjdk-debugsource-11.0.14.0-3.74.2 java-11-openjdk-demo-11.0.14.0-3.74.2 java-11-openjdk-devel-11.0.14.0-3.74.2 java-11-openjdk-headless-11.0.14.0-3.74.2

References

#1194925 #1194926 #1194927 #1194928 #1194929

#1194930 #1194931 #1194932 #1194933 #1194934

#1194935 #1194937 #1194939 #1194940 #1194941

Cross- CVE-2022-21248 CVE-2022-21277 CVE-2022-21282

CVE-2022-21283 CVE-2022-21291 CVE-2022-21293

CVE-2022-21294 CVE-2022-21296 CVE-2022-21299

CVE-2022-21305 CVE-2022-21340 CVE-2022-21341

CVE-2022-21360 CVE-2022-21365 CVE-2022-21366

CVSS scores:

CVE-2022-21248 (NVD) : 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21248 (SUSE): 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21277 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21277 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21282 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2022-21282 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2022-21283 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21283 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21291 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21291 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21293 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21293 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21294 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21294 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21296 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2022-21296 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE-2022-21299 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21299 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21305 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21305 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVE-2022-21340 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21340 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21341 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21341 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21360 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21360 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21365 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21365 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21366 (NVD) : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVE-2022-21366 (SUSE): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected Products:

SUSE Linux Enterprise Desktop 15-SP3

SUSE Linux Enterprise High Performance Computing 15-SP3

SUSE Linux Enterprise Module for Basesystem 15-SP3

SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3

SUSE Linux Enterprise Realtime Extension 15-SP2

SUSE Linux Enterprise Server 15-SP3

SUSE Linux Enterprise Server for SAP Applications 15-SP3

SUSE Manager Proxy 4.2

SUSE Manager Server 4.2

https://www.suse.com/security/cve/CVE-2022-21248.html

https://www.suse.com/security/cve/CVE-2022-21277.html

https://www.suse.com/security/cve/CVE-2022-21282.html

https://www.suse.com/security/cve/CVE-2022-21283.html

https://www.suse.com/security/cve/CVE-2022-21291.html

https://www.suse.com/security/cve/CVE-2022-21293.html

https://www.suse.com/security/cve/CVE-2022-21294.html

https://www.suse.com/security/cve/CVE-2022-21296.html

https://www.suse.com/security/cve/CVE-2022-21299.html

https://www.suse.com/security/cve/CVE-2022-21305.html

https://www.suse.com/security/cve/CVE-2022-21340.html

https://www.suse.com/security/cve/CVE-2022-21341.html

https://www.suse.com/security/cve/CVE-2022-21360.html

https://www.suse.com/security/cve/CVE-2022-21365.html

https://www.suse.com/security/cve/CVE-2022-21366.html

https://bugzilla.suse.com/1194925

https://bugzilla.suse.com/1194926

https://bugzilla.suse.com/1194927

https://bugzilla.suse.com/1194928

https://bugzilla.suse.com/1194929

https://bugzilla.suse.com/1194930

https://bugzilla.suse.com/1194931

https://bugzilla.suse.com/1194932

https://bugzilla.suse.com/1194933

https://bugzilla.suse.com/1194934

https://bugzilla.suse.com/1194935

https://bugzilla.suse.com/1194937

https://bugzilla.suse.com/1194939

https://bugzilla.suse.com/1194940

https://bugzilla.suse.com/1194941

Severity

Announcement ID: SUSE-SU-2022:0816-1

Rating: moderate

What Are You Looking For?

SUSE: 2022:0816-1 moderate: java-11-openjdk

Summary

References

Kali Linux 2023.4 Released With New Hacking Tools

Krasue RAT Malware Hides on Linux Servers Using Embedded Rootkits

Nitrux 3.2.0 Linux Distro Released with Enhanced Security and New Features

Severe Firefox, Thunderbird Bugs Could Lead to System Takeover

News

Advisories

HOWTOs

Features

Password Guessing as an Attack Vector

Using Open Source to Ensure Compliance & Data Integrity through Data Governance

Critical Linux Kernel Bugs Lead to DoS, Privilege Escalation - Patch Now!

Unlocking the Future of Authentication: Passkeys vs. Passwords

Empowering MSPs with Straightforward Linux Device Management

About Us

Powered By

What Are You Looking For?

SUSE: 2022:0816-1 moderate: java-11-openjdk

Summary

References

Get the Latest News & Insights

Related News

News

Advisories

HOWTOs

Features

About Us

Powered By